Source-device-independent heterodyne-based quantum random number generator at 17 Gbps

Random numbers are commonly used in many different fields, ranging from simulations in fundamental science to security applications. In some critical cases, as Bell’s tests and cryptography, the random numbers are required to be both private and to be provided at an ultra-fast rate. However, practical generators are usually considered trusted, but their security can be compromised in case of imperfections or malicious external actions. In this work we introduce an efficient protocol which guarantees security and speed in the generation. We propose a source-device-independent protocol based on generic Positive Operator Valued Measurements and then we specialize the result to heterodyne measurements. Furthermore, we experimentally implemented the protocol, reaching a secure generation rate of 17.42 Gbit/s, without the need of an initial source of randomness. The security of the protocol has been proven for general attacks in the finite key scenario.


I. INTRODUCTION
The possibility of generating random numbers by quantum processes is an invaluable resource in cryptography.Nowadays, common solutions based on Pseudo or classical Random Number Generators rely on deterministic processes, which are in principle predictable.On the contrary, Quantum Mechanics guarantees, from a theoretic point of view, that the outcome of the measurement is completely unpredictable.However, any imperfection in the physical realization of quantum random number generators (QRNG) can leak information correlated with the generated numbers, the so called side information.Such classical or quantum correlations could be exploited by an eavesdropper to correctly guess the measurement outcomes.
The maximal amount of randomness that can be extracted in presence of such side information is given by the so called quantum conditional min-entropy [1].Several approaches have been proposed to lower bound it, depending on the number of assumptions required on the devices used in the generator.For "fully trusted" QRNGs [2][3][4], the min-entropy can be evaluated because pure input states and well characterized measurement devices are assumed (see [5] for more details).In contrast, device independent (DI) protocols, by exploiting entanglement, don't need any assumption: the violation of a Bell inequality directly bounds the min-entropy, without the need of trusting the generated state and the used measurement devices.Fully trusted QRNG, including all the commercial ones, are easy to realize, but they require strong assumptions for their use in cryptography.On the contrary, DI protocols offer the highest level of security, but their realization is still too demanding for any practical use [6][7][8][9][10].
Semi-device-independent (Semi-DI) protocols [11], are a promising approach to enhance the security with respect to standard "fully trusted" QRNG, achieving fast generation rate, dramatically larger than DI-QRNG.These require some weaker assumptions to bound the side information.Such assumptions can be related to the dimension of the underlying Hilbert space [12,13], the measurement device [5,10,[14][15][16] or the source [17], for example the mean photon number [18] or the maximum overlap [19] of the emitted states.
In this work we introduce a QRNG belonging to the family of the Semi-DI generators.In particular, we will describe a novel source-device independent (SDI) protocol by exploiting continuous variable (CV) observables of the electromagnetic (EM) field.In previously realized CV-QRNGs [14,20], random numbers were generated by using a homodyne detector that measures a quadrature of the EM field.We propose and demonstrate a CV-QRNG based on heterodyne detection in the SDI framework: we will show how it is possible to obtain a lower bound on the eavesdropper quantum side information (i.e. the conditional min-entropy) and to achieve, to our knowledge, the fastest generation rate in the Semi-DI framework.
The advantages of heterodyne measurement over homodyne are multiple: beside offering better tomography accuracy than homodyne [21,22], heterodyne measurement offers an increased generation rate since it allows a "simultaneous measurement" of both quadratures.In addition, the experimental setup is simplified with respect to the protocol based on homodyne introduced in [14], since there is no need of an active switch to measure the two quadratures.Finally, it is possible to derive a constant lower bound on the conditional quantum minentropy, that doesn't change during the experiment.
Our SDI protocol assumes a trusted detector but it does not make any assumption on the source: an eavesdropper may fully control it, manipulating it in order to maximize her ability to predict the outcomes of the generator.Such approach is very effective in taking into account any imperfect state preparation.Moreover, we will show the results of a practical realization of the pro-arXiv:1801.04139v1[quant-ph] 12 Jan 2018 tocol with a compact fiber optical setup that employs only standard telecom components.In this way, we are able to demonstrate a generation rate of secure random numbers greater than 17 Gbit/s.

II. A HETERODYNE QRNG
In standard CV-QRNGs, random numbers are obtained by measuring with an homodyne detector a quadrature observable of the EM fields, typically prepared in a vacuum state.CV-QRNGs are characterized by high generation rates due to the use of fast photodiodes instead of (slow) single photon detectors: continuous spectrum of the observables typically assures more than one bit of entropy per measurement and the use of photodiodes with high bandwidth allow to sample the quadratures at GSample/s.In our QRNG, we implement a heterodyne detection scheme where two "noisy quadrature observables" are measured simultaneously [23,24].More precisely, an heterodyne measurement corresponds to the following Positive Operator Value Measurement (POVM) Πα and |α is the coherent state with complex amplitude α.
If we define ρ A the density matrix of the EM field, the output of the heterodyne measurement is represented by the random variable distributed according to the following probability density function known as Husimi function: In an ideal scenario where the QRNG user (Alice) can trust the source of random states: such scheme has the immediate advantage of doubling the generation rate with respect to an homodyne receiver.Since the "raw" random numbers { eα, mα} are typically not uniformly distributed, it is essential to process them with a randomness extractor [25].A randomness extractor compresses the input string of raw numbers, such that the shorter output string is composed by i.i.d.random bits.
In a fully-trusted QRNG, when the source is trusted and the input state is pure (such as for the vacuum) or the privacy of the generated numbers is not a concern, the number of random bits that can be extracted per sample is given by the so called classical min-entropy of X However, ultrafast generation is worthless for crypto-graphic applications if the numbers are not secure and private.If security is important, quantum side information must be also taken into account and the conditional quantum min-entropy H min (X|E) [1] must be evaluated.We recall that in the SDI framework an eavesdropper may have full control of the source and then may have some prior information on the generated numbers.We will show that with a heterodyne scheme it is possible to generate unpredictable and secure numbers also when the source of quantum states is controlled by the eavesdropper.

III. A SECURE HETERODYNE (OR POVM) QRNG
A. Security of the CV protocol In our SDI framework, Alice does not make any assumption on ρ A , such as its dimension or purity: the source may be even controlled by a malicious QRNG manufacturer, Eve.This framework is well suited to deal with imperfect sources of quantum states [5].On the contrary, Alice carefully characterizes her local measurement apparatus and trusts it.
In this scenario, Eve is assumed to prepare the state ρ A to be measured.In particular, Eve will prepare ρ A in order to maximize her guessing probability P guess of the outcomes of Alice heterodyne measurement.If the state ρ A is not pure, it can be prepared by Eve as a incoherent superposition of states τ A β with probabilities p(β), such as ρ A = p(β)τ A β dβ.As shown below, for quantum state ρ A with positive Glauber-Sudarshan representation, Eve optimizes her strategy by using τ A β that are coherent states.
When Eve generates the state τ A β , the best option for her is to bet on the heterodyne outcome with higher probability, namely max α Tr Πα τ A β .On average, Eve's probability of guessing correctly the output of the heterodyne measurement can be written as Having full control of the source, given the state ρ A , Eve chooses the decomposition E = {p(β), τ A β } that maximizes P guess .According to the Leftover Hash Lemma (LHL) [26], the extractable randomness in the presence of side information is quantified by the quantum conditional minentropy where P guess (X|E) is maximum probability of guessing X conditioned on the quantum side information E The maximization in ( 6) is performed over all possi- ble decomposition The above considerations are valid not only for the heterodyne measurement, but are correct for any POVM measurement (also with Hilbert spaces of finite dimensions).Fig. 1 represents a general protocol within this framework.It is worth noticing that P guess is a true probability for finite dimension Hilbert spaces, while it is a probability density for infinite dimension spaces (such as in the case of CV measurements).
By exploiting the properties of POVMs, we now derive a lower bound on H min (X|E) (and thus an upper bound on P guess (X|E)).
Proposition 1.For any POVM { Πx } the quantum conditional min-entropy H min (X|E) is lower-bounded by Proof.Given a set of POVM { Πx }, the maximum over x in (6) is easy bounded by max x Tr Πx τ A β ≤ max x,τ A Tr Πx τA .Then eq. ( 6) is upper bounded by: from which the bound on the min-entropy easily follows by using (5).
If the POVM reduce to projective measurements, the above bound is trivial, since it always possible to find a state τA such that Tr[ Πx τA ] = 1: in this case, no randomness can be extracted.However, for an overcomplete set of POVM we may have max {x,τ A } Tr[ Πx τA ] < 1 and therefore randomness can always be extracted.We now exploit the above proposition for the specific case of heterodyne measurement.
Corollary 1.For the heterodyne measurement the quantum conditional min-entropy H min (X|E) is lowerbounded by log 2 π.The bound is tight for quantum state with positive Glauber-Sudarshan P(α) representation.
Proof.It is well known that the Husimi function is upper bounded by By proposition 1, it follows that H min (X|E) min ≥ log 2 π.To show the tightness, we note that any matrix ρ A can be written as ρ A = P(α)|α α|d 2 α where P(α) is the Glauber-Sudarshan P-function.If P(α) is positive it can be interpreted as a probability density and the state ρ A can be seen as an incoherent superposition of coherent states.Since coherent states maximize the output probability for the heterodyne POVM, then the optimal decomposition in ( 6) is precisely E = {P(α), |α α|} and the quantum conditional min-entropy is exactly H min (X|E) = log 2 π.
By using an heterodyne measurement scheme, a quantum tomography of the input state is also obtained [27]: while Alice generates the raw random numbers, she also reconstructs the state ρ A .Then it is possible to evaluate numerically the quantum conditional min-entropy by using ( 5) and (6).Although for a qubit system, this problem was elegantly addressed by [28], it is not of easy solution in the CV case.On the other hand, Corollary 1 gives an easy lower bound on H min (X|E).Alice knows that even if Eve forges a state with an optimal E, such side information will not let Eve guess the heterodyne outcome with a probability (density) larger than 1  π .In the presence on an imperfect source of quantum states, this is the most conservative strategy to adopt, but ensures the generation of completely secure random numbers while avoiding a complex numerical maximization.
It is worth noticing that in many cases such lower bound is tight: indeed, coherent and thermal states have positive Glauber-Sudarshan P(α) function and for those states the bound log 2 π is tight.Moreover, in contrast to other Semi-DI QRNG where the min-entropy needs to be estimated in real time to provide security [12,14,19], in our protocol it depends on the structure of the heterodyne POVM and it is always constant.Hence, Alice can apply on X a randomness extractor calibrated on log 2 π and erase any guessing advantage of Eve.In the following we adapt the bound of Corollary 1 to realistic POVMs with finite resolution.

B. Practical Bound
In a real implementation, any heterodyne measurement is discretized.This means that the possible outcomes of the measure are discrete with a resolution given by δ q and δ p for the two "quadratures".The discretized version of the POVM Πα is then given by Πδ and the quantum min-entropy is lower bounded by Hence, in the real-life implementation, the min-entropy of the random numbers is bounded by a function that depends on the measurement resolution only.The measurement, in this scenario, is under control of the user: Alice can readily obtain the min-entropy ( 8) by measuring δ p and δ q of her well characterized apparatus.The min-entropy is constant and Alice does not need to worry updating its value, as long as she trusts the apparatus.

IV. EXPERIMENTAL RESULTS
The proposed new protocol has been implemented with an all-fiber setup at telecom wavelength with the scheme in Fig. 2; in this way is possible to exploit the availability of fast off-the-shelf components for classical telecommunication while keeping the setup compact.The heart of the experiment lies in the heterodyne detection of the vacuum state, that samples the Q function with the help of a coherent field |α of a Local Oscillator (LO).We employed a narrow linewidth ECL laser at 1550nm (Thorlabs SFL1550) followed by and electronically-controlled Variable Optical Attenuator (VOA) and a in-line Polarization Controller (PC).In this way we were able to finely control the intensity and the polarization of our LO, besides making the calibration procedure automatized.
Before entering the heterodyne measurement, 10% of the LO is sent to a photodetector, for a continuous monitor of its intensity.By doing that, any anomaly to the normal functioning of the LO can be noticed in realtime, and deviations can be compensated during the post-processing.
The optical heterodyne was realized with a commercial fiber integrated "90 degree hybrid": one port is coupled to the LO while from the other is entering the vacuum state.However, we work in the SDI scenario and, from the point of view of security, this port can be fully con-  The measured variance is slightly larger that the one expected for the vacuum due to the electronic noise that widens the distribution.
The raw data are then digitally filtered, taking only a 1.25 GHz window in the central part of the spectrum obtained by the detectors.This is necessary in order to remove classical noise that is coupled with the detector.Finally, the data are downsampled at 1.25 GSample/s, matching the bandwidth of the signal and removing any correlation introduced by the oversampling.
We acquired 6 • 10 10 measurements obtaining σ 2 Re[α] = 0.55135 ± 0.00001 and σ 2 Im[α] = 0.56732 ± 0.00001.As it can be seen from Fig. 3, the measured Q-function is slightly larger than the one expected for a pure vacuum state, where both variances are expected to be equal to 1/2.The increase of the variances is due to classical noise of the detectors: in our approach, such noise is regarded as a "spreading" of the Q-function and thus is already included in our analysis for the quantum min-entropy.The classical min-entropy H min (X) corresponds to the larger probability of output and it is given by H min (X) = 14.100 .
However, the quantum min-entropy can be lower bounded by eq. ( 8).With the quadrature resolutions used for the experiment, we obtain for an equivalent secure generation rate of 17.42 Gbit/s.It is worth noticing that the high gain in security guaranteed by the conditional quantum min-entropy of eq. ( 10) with respect to the classical min-entropy eq. ( 9) implies a very small reduction of the generation rate (from 14.10 to 13.949 bits per sample).
In addition, these rates are not calculated in the asymptotic regime, i.e. in the limit of infinite repetitions of the protocol, but are valid for single shot measurements.In fact, the conditional min-entropy H min (X|E) is not estimated from the data, but it's bounded considering the structure of the POVM and the optimal strategy for the attacker, making it independent from the number of rounds of the protocol.Finally, a Toeplitz randomness extractor [29] is calibrated using H min (X|E), and extracts the certified numbers from the raw data.As a final check, we applied a series of statistical tests from the DieHarder and NIST suite: all of them are successfully passed, as shown in Appendix C.

V. CONCLUSIONS
In this work we demonstrated the versatility of heterodyne detection scheme for the generation of secure random numbers in a CV-SDI framework, where no assumption on the source of quantum state is required.In fact, exploiting the properties of the POVM implemented by the heterodyne measurement, in Corollary 1 we obtained a direct lower bound to the conditional minentropy, and hence on its security.This bound enables the user to erase all the side information related with an imperfect or malicious source of quantum states.Compared to previous SDI-QRNGs [5,11,14] this security is obtained without affecting the generation rate: in the previous protocols, part of the generated numbers were consumed to estimate and update the bound to the conditional min-entropy.In the protocol introduced here, the bound is constant, since it is determined by the resolution of the trusted measurement apparatus only.Hence, all the secure numbers are available to the user.Such simplification has many advantages for any practical implementation of the protocol.Our approach allows indeed to merge the speed of heterodyne measurements and the security of semi-device-independent protocols.Indeed, we realized the protocol with off-the-shelf components achieving 17.42 Gbit/s rates, which is to our knowledge the fastest random generation rate for a semi-DI QRNG.with the monitor photodiode.For each power, the signal of the balanced detector is recorded and the variance σ 2 V is estimated.As we can see in Fig. 4 the relation is linear for all the tested powers (i.e.we never reached the saturation of the detector's amplifiers).From the fit, m 1 = (2.783± 0.005) • 10 −2 V 2 /W and q 1 = (1.526± 0.005) • 10 −5 V 2 for the slope and intercept of the first detector and m 2 = (2.748±0.004)•10−2 V 2 /W and q 2 = (1.419±0.004)•10−5 V 2 for the second one.The slopes were used to convert the measured voltages into phase-space quantities.The non-null intercept in both cases is caused by the electronic excess noise from the detectors and, since does not originate from the quantum measurement, is regarded a side-information available to Eve.  6. Spectrum obtained from the detectors with or without the LO active.In green is highlighted the portion kept after the digital filtering and used for the generation.The peaks present after the 3dB point of the detectors are introduced by the oscilloscope at harmonics of the sampling frequency and are not present if the spectrum is obtained with an analog spectrum analyzer (HP 8561B).
To further reduce the classical noise from the detectors (at the expense of a reduced generation rate) we perform a filtering of the signal, as it can be see in the full schematic of the setup presented in Figure 5.
Figure 6 shows the power spectral density of the signal produced by the detectors when the LO is turned on and when the LO is off.Although, the response seems uniform along the entire bandwidth of the detectors (1.6GHz), the initial part of the spectrum (DC − 1MHz) is affected by technical noise.In order to filter out this noise and enhance the signal-to-noise ratio, we have considered for the random generation only a window large 1.25GHz centered around 875MHz.With this selection, the gap is never lower than 9.6dB.The selection has been done digitally.However, employing a Brick-wall filter in the frequency domain, inevitably induces correlation in the time-domain of our signal: indeed we observe a sinc dependence in the autocorrelation, as expected from the Wiener-Khinchin theorem.The correlation is removed by undersampling the signal in such a way to match the first zero of the autocorrelation function.Figure 7 shows the residual autocorrelation after the downsampling, before and after the randomness extraction for a run of 5 • 10 7 samples.The results, even before the extraction, are good, with values always below 7.5 • 10 −3 and typically below 1 • 10 −4 , except for the first lags.The value of the first lag is due to noise introduced by the oscilloscope at harmonics of its sampling rate frequency.
In Figure 6, these distortions are clearly visible at high frequencies, where there is no contribution from the signal.However, after the extractor, all the classical noise is eliminated and the autocorrelation is completely flat, also for the initial lags.

FIG. 2 .
FIG. 2. Schematic representation of the experimental setup.Only commercial off-the-shelf devices were used.
trolled by Eve, since we don't assume anything about the source.The 90 degree hybrid mixes the signal with the LO and returns two pairs of outputs, featuring a π /2 phase shift.These optical signals, detected by a couple of high-bandwidth balanced detectors (1.6 GHz Thorlabs-PDB480C), are proportional to the quadratures of the signal, Re[α], Im[α].We sampled both signals coming from the detectors using a fast oscilloscope with a sampling rate of 10 GSamples/s at 10 bits of resolution (Lecroy HDO 9404).Each samples contains 20 bits of raw data, 10-bit for Re[α] and 10-bit for Im[α].The raw signals of the ADC are proportional to the quadratures and directly sample the Q-function in the phase space, as shown in Fig. 3.The resolution of the ADC can be directly converted to the equivalent resolution in the phase space; in our case we got δRe [α] = (14.05± 0.02) • 10 −3 and δIm [α] = (14.14± 0.02) • 10 −3 , respectively.

FIG. 3 .
FIG. 3. The plot shows the Husimi function for the vacuum (meshed curve) and the measured state (colored histogram).The measured variance is slightly larger that the one expected for the vacuum due to the electronic noise that widens the distribution.

FIG. 5 .
FIG. 5. Schematic representation of the experimental setup.The elements present are: Laser source used for the Local Oscillator (LO), Variable Optical Attenuator (VOA), Fiber Polarization Controller (PC), Fiber Beam Splitter (BS), a 90deg Optical Hybrid, a couple of High-Speed balanced photodetectors, a fast oscilloscope used as an Analog-to-Digital Converter (ADC), PC for the digital filtering and extraction FIG.6.Spectrum obtained from the detectors with or without the LO active.In green is highlighted the portion kept after the digital filtering and used for the generation.The peaks present after the 3dB point of the detectors are introduced by the oscilloscope at harmonics of the sampling frequency and are not present if the spectrum is obtained with an analog spectrum analyzer (HP 8561B).

FIG. 7 .
FIG. 7. Autocorrelation measured for a sample of 5 • 10 7 filtered and extracted numbers.The spikes present in the first lags before the extraction are due to the noise introduced by our sampling equipment.However, they are completely absent after the extraction.
FIG.1.In the general SDI scenario, Eve prepares the state ρA that she sends to Alice such that her purification gives her the maximal guessing probability on Alice's outcome.The structure of the POVM chosen by Alice to measure ρA already impose a lower bound on Hmin(X|E), independently from the input state or the output of her measurement (see Proposition 1).This bound is used to calibrate an extractor that returns secure random bits when applied to Alice's outcomes.